VND-004 Cloud Service Provider Security Management
Description
A documented process governs the selection, security assessment, configuration, monitoring, and exit from cloud service providers (IaaS, PaaS, SaaS). Shared responsibility boundaries are documented. CSP security configurations are reviewed against organisational baseline standards. Exit provisions and data portability requirements are addressed contractually.
Rationale
Cloud providers underpin most product architectures but shared responsibility confusion is a leading cause of cloud misconfiguration breaches. Explicit CSP management is required where cloud services are the primary infrastructure.
Applicability (9 profiles)
The control through which the deployer evidences every hosted-tier control inherited from a cloud provider.
The control through which the deployer evidences every hosted-tier control inherited from a cloud provider.
Framework Mappings (11)
| IPY-04 | Data Portability Contractual Obligations | partial |
| STA-11 | Primary Service and Contractual Agreement | partial |
| IPY-04 | Data Portability Contractual Obligations | partial |
| STA-11 | Primary Service and Contractual Agreement | partial |
| 5.23 | Information security for use of cloud services | full |
| NIS2-CIR-5.1 | Supply Chain Security Policy | informative |
| AU-16 | Cross-organizational Audit Logging | informative |
| CA-2(3) | Control Assessments | Leveraging Results from External Organizations | informative |
| SA-9 | External System Services | informative |
| SR-2 | Supply Chain Risk Management Plan | partial |
| GOVERN 6.1 | Third-Party AI Risk Policies | partial |
Evidence (2)
Cloud service provider management policy documenting selection criteria, shared responsibility documentation requirements, configuration baseline standards, and exit procedures.
Example: Cloud Security Policy (Confluence), approved by CISO, defining: CSP due diligence requirements, mandatory shared responsibility matrix, minimum security configuration baselines (e.g. CIS Benchmarks), contractual data portability requirements, and exit planning obligations
Test: Request the cloud security or provider management policy. Verify: (1) it requires a shared responsibility matrix for each provider in use, (2) it references a published security configuration benchmark for the providers in use, (3) it requires contractual data portability terms, (4) it requires exit planning, (5) it carries an approval within the defined interval.
Completed shared responsibility matrix for the primary cloud provider documenting which controls are CSP-managed, organisation-managed, or shared.
Example: Shared Responsibility Matrix (Confluence / spreadsheet) for the primary CSP (e.g. AWS, GCP, Azure), mapping each control domain to CSP / Organisation / Shared responsibility, with references to CSP documentation confirming CSP-owned controls and internal evidence for organisation-owned controls
Test: Request the shared responsibility matrix for the primary CSP. Verify: (1) covers all major control domains (physical security, network, platform, identity, data, application), (2) organisation-owned controls have corresponding evidence artefacts referenced, (3) matrix has been reviewed within 12 months, (4) reviewed and approved by the CISO or equivalent.
Questions (2)
Is there a documented process governing the selection, security assessment, configuration, monitoring and exit of cloud service providers?
The process should include security baseline configuration standards (e.g. CIS Benchmarks), documented shared responsibility boundaries, and contractual data portability and exit provisions. Misconfiguration of cloud services is a leading cause of security incidents.
Which elements of cloud service provider security management are formally documented in your organisation?
A shared responsibility matrix and documented configuration baseline are the minimum expected artefacts. Exit planning is critical to ensure data can be recovered or migrated if the CSP relationship ends.